Forum Discussion
Powershell Deobsfuscation Ep.7
I first collected the .ps1 script
and noticed that it is from hex
after decoding from hex
I noticed that it converts from decimals
This led me to use the from the from decimal recipe from Cyberchef
However, this led me towards only the decoded eding of the script itself.
with the main obfuscated payload being empty.
I am wondering about where I am going wrong in my thought process.
1 Reply
- SamDickison
Community Manager
It looks like you're on the right track by identifying the layer of decimal conversion, but running the From Decimal recipe on the entire PowerShell wrapper script is causing CyberChef to break or output empty data.
To proceed, look closely at how the script handles the massive data arrays—specifically the strings broken into sections like 1: [STRING]::Join(...) and 2: [STRING]::Join(...). You need to isolate just the raw, comma-separated decimal numbers of the main payload from those specific variables, strip out the PowerShell code, and pass only those numeric values into your CyberChef recipe.
